Data anomaly diagnosis method and system based on knowledge graph and large model

Abstract

The invention discloses a data anomaly diagnosis method and system based on a knowledge graph and a large model. According to the method, multi-source data including structured database records, semi-structured technical documents and unstructured expert experience descriptions are obtained and preprocessed, a knowledge graph containing entity, relation and attribute levels is established, domain adaptation training is conducted on a large language model through the knowledge graph, and the large language model is obtained. And constructing a hierarchical reasoning framework to realize data exception identification, diagnosis and solution generation. The method solves the technical problems of non-uniform knowledge representation, limited diagnosis capability, single reasoning logic and the like of a traditional data anomaly diagnosis method, and has the following advantages: uniform representation and storage of multi-source heterogeneous data are realized; the domain understanding ability of the large language model is improved through knowledge injection; the accuracy and efficiency of abnormality diagnosis are improved by adopting a hierarchical reasoning framework; and experience accumulation and continuous optimization are supported, and high practicability and expansibility are achieved.

Description

Technical Field

[0001] The present invention relates to the field of data governance technology, and in particular to a data anomaly diagnosis method and system based on knowledge graph and big model. Background Art

[0002] With the deepening of digital transformation, enterprises are facing the challenge of managing massive heterogeneous data. As a key link in data governance, data anomaly diagnosis is of great significance to ensuring data quality and business continuity. At present, data anomaly diagnosis mainly adopts methods such as rule matching, statistical analysis and machine learning. Among them, the rule matching method identifies anomalies through preset rules, the statistical analysis method finds anomalies based on data distribution characteristics, and the machine learning method automatically detects abnormal patterns through training models.

[0003] However, existing technologies have obvious deficiencies in practical applications. In the process of daily data governance in enterprises, due to the diversity of data sources, existing methods often need to adopt different processing solutions for different types of data, such as using SQL rules to handle anomalies in relational databases, using regular expressions to handle abnormal information in log files, and manually processing unstructured fault reports. This fragmented knowledge representation method not only increases maintenance costs, but also makes it difficult to establish correlations between anomalies, making the diagnosis process lack of systematicity.

[0004] At the same time, traditional anomaly diagnosis methods rely too much on pre-defined rule sets and historical data, and are often unable to diagnose and handle new anomalies brought about by changes in the business environment in a timely and effective manner. For example, the problem of cross-system data inconsistency that occurs during data integration may involve complex interactions between multiple systems and multiple links, and it is difficult to accurately locate the root cause by relying solely on a single rule or statistical model.

[0005] In addition, enterprises have accumulated a large amount of expert experience and best practices in the course of long-term operations, but this valuable knowledge often exists in unstructured forms such as documents, emails or oral communication, which is difficult to be effectively utilized by existing diagnostic systems.

[0006] More importantly, existing methods lack flexible reasoning mechanisms and are unable to dynamically adjust diagnostic strategies according to the urgency and complexity of the anomaly, resulting in the diagnosis of simple problems taking too long, while complex problems are difficult to obtain timely and accurate solutions.

[0007] With the continuous growth of data volume and the continuous enrichment of business scenarios, how to effectively accumulate and reuse the new diagnostic experience and achieve continuous improvement of diagnostic capabilities has become another important challenge facing existing technologies. Summary of the invention

[0008] In order to solve the technical problems in the existing data anomaly diagnosis, such as inconsistent knowledge representation, limited diagnostic ability, single reasoning logic and difficulty in accumulating experience, the present invention proposes a data anomaly diagnosis method based on knowledge graph and big model, which improves the intelligence level of data anomaly diagnosis by fusing multi-source heterogeneous data, constructing multi-level knowledge graph, introducing big language model capability and realizing hierarchical reasoning.

[0009] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0010] A data anomaly diagnosis method and system based on knowledge graph and big model, comprising the following steps:

[0011] Acquire and preprocess multi-source data, including structured database records, semi-structured technical documents, and unstructured expert experience descriptions, and convert various types of data into a unified knowledge representation format through different preprocessing strategies;

[0012] Constructing a knowledge graph based on the preprocessed data, wherein the knowledge graph includes an entity level, a relationship level, and an attribute level, and realizing systematic storage of data anomaly diagnosis knowledge through multi-level knowledge representation;

[0013] The knowledge graph is used to perform domain adaptation training on the large language model. By injecting professional vocabulary and domain knowledge, combined with the design of prompt templates and parameter fine-tuning, a training model with data anomaly diagnosis capability is obtained.

[0014] A hierarchical reasoning framework is constructed based on the training model and the knowledge graph. Through the coordinated operation of fast reasoning, deep reasoning, and solution reasoning, abnormality identification, diagnosis, and solution generation are achieved, and reasoning experience is continuously accumulated in the knowledge graph.

[0015] Further, preprocessing the multi-source data includes: performing field mapping and data cleaning on the structured database records, establishing field mapping relationships by identifying key fields in the data table, performing data format unification and deduplication processing, and filtering and correcting outliers and noise data;

[0016] Template parsing and rule extraction are used for the semi-structured technical documents, a parsing template is constructed based on the structural features of the documents, key information is extracted using regular expressions, and the extracted information is converted into a unified data format;

[0017] Using a large language model to perform semantic understanding and information extraction on the unstructured expert experience description, identify professional terms, diagnostic rules and processing methods in the text, extract key information on abnormal description, cause analysis and solution, and convert unstructured information into structured knowledge representation;

[0018] The above preprocessed data are integrated and converted into knowledge triples of subject, predicate and object, including entity triples, relationship triples and attribute triples, for the subsequent construction of knowledge graph.

[0019] Furthermore, the steps of constructing the knowledge graph include: constructing an entity hierarchy based on the preprocessed data, constructing a relationship hierarchy based on the entity hierarchy, and constructing an attribute hierarchy around entities and relationships.

[0020] Furthermore, the entity hierarchy establishes a basic entity framework through the hierarchical relationship of data source systems, transmission nodes, processing components and storage facilities, and defines exception type entities and solution entities on this basis to form a complete entity system.

[0021] Furthermore, the relationship hierarchy includes: establishing data flow relationships, using directed edges to represent the transmission direction, frequency and amount of data between systems, and describing the data transmission path between systems; building a component dependency network, establishing a directed weighted graph based on the calling frequency, data interaction volume and configuration item correlation between components, and describing the strength of the dependency relationship between components; defining diagnostic knowledge relationships, including the attribution relationship between anomaly type and root cause, the mapping relationship between anomaly and diagnostic solution, and the evaluation relationship between solution and solution effect, to form a complete problem diagnosis knowledge network.

[0022] Furthermore, in the attribute hierarchy, basic attributes are used to describe the inherent characteristics of an entity, business attributes are used to characterize the business characteristics of an entity, and dynamic attributes are used to record state changes of an entity, forming a multi-dimensional attribute system.

[0023] Furthermore, the steps of domain adaptation training for the large language model include:

[0024] Build a professional vocabulary in a specific field based on the knowledge graph, extract entities and attributes from the knowledge graph to form a core vocabulary set, combine the large language model to analyze technical documents to identify new professional terms, automatically check and classify the professional vocabulary based on the preset domain vocabulary specifications, manually review and confirm the new professional terms, establish the upper and lower relationships and synonymous relationships between words, and form a structured professional vocabulary system;

[0025] Design prompt templates according to the characteristics of abnormal diagnosis tasks. The prompt templates include abnormal description templates, cause analysis templates, solution templates, and verification feedback templates. Set corresponding trigger conditions and usage strategies for different types of abnormal scenarios, and dynamically optimize template content based on actual application effects.

[0026] Convert professional rules, diagnostic experience and typical cases in the knowledge graph into training corpus in natural language, inject domain knowledge into model parameters through prompt learning, and enhance the model's ability to understand domain knowledge;

[0027] The LoRA low-rank adaptation technique is used to fine-tune the model parameters.

[0028] Furthermore, hierarchical reasoning is constructed, including:

[0029] Perform fast reasoning, identify anomalies based on the preset rule patterns and statistical features in the knowledge graph, understand the anomaly description content in combination with the large language model, classify the identified anomalies and determine the processing priority;

[0030] Perform deep reasoning based on fast reasoning, retrieve historical experience and expert knowledge in the knowledge graph, use the large language model to analyze the current scene characteristics, build anomaly propagation links through predefined causal patterns and shortest path analysis between nodes in the knowledge graph, and identify the source node and impact range of the anomaly;

[0031] Perform solution reasoning based on the reasoning results, retrieve matching historical cases from the knowledge graph, use the large language model to understand the current scenario constraints, and reason out the optimal solution through combinatorial optimization;

[0032] The reasoning process at each level forms a closed-loop feedback, the reasoning results are interpreted and analyzed through a large language model, and the reasoning experience is written back into the knowledge graph for experience accumulation and rule optimization.

[0033] The present invention also discloses a data anomaly diagnosis system based on a knowledge graph and a large model, comprising:

[0034] A knowledge management module is used to build and maintain a knowledge graph. The knowledge management module builds entity, relationship and attribute hierarchies based on preprocessed multi-source data, and realizes efficient access to knowledge through a knowledge storage unit and a knowledge retrieval unit, while maintaining the timeliness and consistency of knowledge;

[0035] A model processing module is used to perform training and reasoning of a large language model. The model processing module performs adaptive training on the model based on the domain knowledge in the knowledge graph, processes natural language input through a semantic understanding unit, and implements hierarchical reasoning functions using an inference execution unit;

[0036] The hierarchical reasoning module is used to perform abnormal diagnosis tasks. The hierarchical reasoning module uses a fast reasoning unit to perform preliminary abnormality identification and classification, uses a deep reasoning unit combined with a knowledge graph to analyze the root cause, generates an optimal solution through a solution reasoning unit, and feeds back the reasoning results to the knowledge graph for experience accumulation.

[0037] The present invention has the following beneficial effects:

[0038] Significantly reduces the labor cost of data anomaly diagnosis: By introducing the collaborative mechanism of large language models and knowledge graphs, the present invention can automatically handle most common data anomaly problems, greatly reducing the need for manual intervention. At the same time, through a unified knowledge representation framework, the operation and maintenance costs of maintaining multiple diagnostic systems are effectively reduced.

[0039] Improved the efficiency and accuracy of anomaly diagnosis: Based on the hierarchical reasoning framework, simple anomalies can be diagnosed quickly, and complex anomalies can also maintain a high root cause location accuracy. Especially in complex scenarios such as cross-system data integration, it can effectively track the anomaly propagation path and accurately locate the source of the problem.

[0040] Effective accumulation of expert experience: This method innovatively transforms unstructured expert experience into computable knowledge in the knowledge graph, achieving structured expression and automated application of experience. Compared with traditional document methods, this method significantly improves the efficiency of knowledge reuse.

[0041] Enhanced the intelligence level of exception handling: Through domain adaptation training of large language models, the system can understand most business terms and professional expressions, and can perform intelligent analysis and diagnosis on newly emerging exception types, breaking through the limitations of traditional rule systems.

[0042] Possess continuous optimization capability: The present invention has designed a complete closed-loop feedback mechanism, and the experience accumulated during the diagnosis process can be automatically deposited into the knowledge graph. The system's diagnostic capability will continue to improve with the increase of usage time, and the accuracy of abnormality identification will be continuously optimized. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the implementation of the present invention or the existing technical solutions, the following briefly introduces the drawings required to be used in the embodiments or the description of the prior art.

[0044] Figure 1 Flowchart of the construction and reasoning method of the big model knowledge graph for data governance.

[0045] Figure 2 This is a schematic diagram of the three-layer structure of the knowledge graph.

[0046] Figure 3 Implement a flow chart for the hierarchical reasoning framework. DETAILED DESCRIPTION

[0047] The above detailed description is a specific description of a feasible embodiment of the present invention. The embodiment is not intended to limit the patent scope of the present invention. Any equivalent implementation or modification that does not deviate from the present invention should be included in the patent scope of this case.

[0048] Reference Figure 1 The main steps of the data anomaly diagnosis method based on knowledge graph and large model provided by the present invention are as follows:

[0049] (1) Acquire and preprocess multi-source data, including structured database records, semi-structured technical documents, and unstructured expert experience descriptions, and transform various types of data into a unified knowledge representation format through different preprocessing strategies;

[0050] (2) Based on the preprocessed data, a knowledge graph is constructed, which includes entity level, relationship level and attribute level, and the systematic storage of data anomaly diagnosis knowledge is realized through multi-level knowledge representation;

[0051] (3) Using knowledge graphs to perform domain adaptation training on large language models, by injecting professional vocabulary and domain knowledge, combined with the design of prompt templates and parameter fine-tuning, a training model with data anomaly diagnosis capabilities is obtained;

[0052] (4) Build a hierarchical reasoning framework based on the training model and knowledge graph. Through the coordinated operation of fast reasoning, deep reasoning, and solution reasoning, it can realize the identification, diagnosis, and solution generation of anomalies, and continuously accumulate reasoning experience into the knowledge graph.

[0053] As a preferred embodiment of the present invention, in step (1), the preprocessing process of multi-source data is as follows:

[0054] (1-1) Preprocessing of structured database records: First, identify key business tables and fields and establish a field mapping rule library; perform data cleaning, including data type unification and deduplication processing; finally, filter and correct outliers and noise data to ensure that data from different sources conform to unified format specifications.

[0055] (1-2) Preprocessing of semi-structured technical documents: Establish a document parsing template library, build a parsing template based on the structural features of the document, use regular expressions to extract key information, and convert the extracted information into structured data according to the predefined schema.

[0056] (1-3) Preprocessing of unstructured expert experience descriptions: Use large language models for semantic understanding and information extraction to identify professional terms, diagnostic rules, and processing methods in the text; extract key information such as exception descriptions, cause analysis, and solutions, and convert the extracted information into a structured knowledge representation format.

[0057] As a preferred embodiment of the present invention, refer to Figure 2In step (2), the knowledge graph is constructed using a bottom-up hierarchical construction strategy, including entity level, relationship level and attribute level. These three levels are interconnected through unique identifiers and together constitute a complete knowledge network. Specifically, the following steps are included:

[0058] (2-1) Entity hierarchy construction: First, define the core entity types, mainly including basic entities such as data source systems, transmission nodes, processing components, and storage facilities. Each entity type has a unified naming convention and unique identifier; then establish an exception type entity system, using a hierarchical classification structure, including data quality exceptions (integrity exceptions, accuracy exceptions, consistency exceptions, timeliness exceptions), system operation exceptions (performance exceptions, resource exceptions, connection exceptions, configuration exceptions), business rule exceptions (logic exceptions, threshold exceptions, process exceptions, and permission exceptions); finally, build a solution entity library, and establish corresponding processing methods (including automatic repair, manual intervention, downgrade processing, etc.), optimization suggestions (including system configuration optimization, resource expansion, rule adjustment, etc.), and preventive measures (including monitoring and early warning, regular inspections, capacity planning, etc.) for each type of exception.

[0059] (2-2) Relationship hierarchy construction: First, establish the data flow relationship, and use directed edges to represent the data transmission direction (upstream and downstream dependencies), transmission frequency (real-time, quasi-real-time, batch, etc.) and data volume (KB, MB, GB, etc.) between systems, so as to form a complete data flow topology diagram; secondly, build a component dependency network, and establish a directed weighted graph based on the call frequency, data interaction volume, and configuration item correlation between components to quantitatively describe the strength of the dependency relationship between components; finally, define the diagnostic knowledge relationship, including the attribution relationship between the anomaly type and the root cause, the mapping relationship between the anomaly and the diagnostic solution, and the evaluation relationship between the solution and the solution effect, so as to form a traceable diagnostic knowledge network.

[0060] (2-3) Attribute hierarchy construction: First, define basic attributes, including entity ID (globally unique identifier), creation time (timestamp when the entity was first created), update time (timestamp when the entity was last modified), and status identification (active, invalid, pending, etc.); secondly, configure business attributes, including data volume threshold (data volume range for normal operation), update frequency (time interval for data update), quality standard (data quality evaluation indicator), and importance (severity level of business impact); finally, set dynamic attributes, including operating status (normal, abnormal, warning, etc.), abnormal frequency (number of abnormalities occurring per unit time), impact scope (number of related entities affected), and processing progress (degree of completion of abnormal resolution).

[0061] Through the construction of the above three levels, a complete knowledge representation framework is formed, which realizes the structured storage and efficient retrieval of knowledge, and provides a knowledge basis for subsequent model training and reasoning.

[0062] As a preferred implementation scheme of the present invention, in step (3), the domain adaptation training of the large language model adopts a progressive training strategy, through three stages of professional vocabulary injection, prompt template construction and parameter optimization, to achieve the model's deep understanding and application of data governance domain knowledge. Specifically, the following steps are included:

[0063] (3-1) Construction of professional vocabulary: First, entities and attributes are systematically extracted from the knowledge graph to form an initial core vocabulary set, including basic terms, anomaly types, diagnostic methods, etc. in the field of data governance; then, the large language model is used to scan and analyze technical documents, feature vectors are extracted from each document, and newly emerging professional terms and domain expressions are identified through cosine similarity calculation (the threshold is set to 0.85); then, based on the preset domain vocabulary specifications, the professional vocabulary is automatically verified and classified using word frequency statistics (the minimum word frequency threshold is set to 5) and co-occurrence analysis (the window size is set to 5 words), and the newly added professional terms are manually reviewed and confirmed; finally, the hierarchical clustering algorithm (the clustering threshold is set to 0.7) is used to establish the hierarchical and synonymous relationships between words, and the scattered professional vocabulary is integrated into a structured professional vocabulary system to achieve standardized vocabulary management.

[0064] (3-2) Prompt template design: First, construct an exception description template, design a template structure containing variable slots such as {anomaly type}, {timestamp}, {impact scope}, and {severity}, to standardize the expression of abnormal phenomena; second, design a cause analysis template, including key information slots such as {possible cause}, {impact path}, and {verification method}, to guide the model to conduct systematic root cause analysis; then formulate a solution template, decompose the processing steps into structured components such as {preconditions}, {operation steps}, {resources required}, and {expected effects}, to ensure the output of standardized and executable processing suggestions; finally, develop a verification feedback template, design feedback collection items such as {execution results}, {problem feedback}, and {optimization suggestions}. The template is dynamically optimized through template similarity calculation (the similarity threshold is set to 0.8), and trigger conditions and usage strategies based on rule weights (the initial weight is set to 1.0) are set for different types of abnormal scenarios.

[0065] (3-3) Model training optimization: First, the professional rules, diagnostic experience and typical cases in the knowledge graph are structured and converted into training data pairs in the form of <input description, expected output>. Each training sample contains three key parts: abnormal description, root cause analysis and solution. Then, the LoRA low-rank adaptation technology is used to fine-tune the model. The specific configuration includes: low-rank matrix decomposition with rank = 8, the learning rate is set to 2e-4, the AdamW optimizer is used, the weight decay coefficient is 0.01, and the learning rate scheduling strategy of linear warmup (warmup_ratio = 0.1) and cosine decay is used during training. The batch size of 16 is used for training, and 3 epochs are trained on a data set containing 10,000 training samples. A validation evaluation is performed every 500 steps. When the performance does not improve after 3 consecutive validations, the training is terminated early. Finally, the trained model is evaluated by perplexity (the threshold is set to be less than 1.5) and the professional instruction evaluation set (the accuracy is required to be greater than 95%) to ensure that the model has reliable abnormal diagnosis capabilities.

[0066] As a preferred embodiment of the present invention, refer to Figure 3 In step (4), the hierarchical reasoning framework adopts a multi-level linkage reasoning mechanism to achieve rapid identification, accurate diagnosis and optimal solution of abnormalities through the coordinated cooperation of three levels: fast reasoning, deep reasoning and solution reasoning. Specifically, it includes the following steps:

[0067] (4-1) Fast reasoning: First, feature extraction is performed based on the preset rule patterns in the knowledge graph, including data volume anomaly detection (based on the 3-sigma principle, setting the fluctuation threshold to ±3 times the standard deviation), update delay detection (setting the maximum tolerable delay to 30 minutes), data quality detection (integrity threshold>99%, accuracy threshold>98%), etc.; then, preliminary classification is performed based on statistical features, and a time-based anomaly detection algorithm (the sliding window size is set to 24 hours and the sampling interval is 5 minutes) is used to calculate the historical distribution characteristics of key indicators; finally, a large language model is used to understand the anomaly description content, and the anomalies are classified based on semantic similarity matching (the threshold is set to 0.85), and the processing priority is determined through a priority scoring model (considering the business impact weight of 0.4, the urgency weight of 0.3, and the processing complexity weight of 0.3).

[0068] (4-2) Deep reasoning: First, historical experience and expert knowledge are retrieved through the graph retrieval algorithm of the knowledge graph (using a bidirectional BFS algorithm with a maximum search depth of 4 layers) to extract similar cases (similarity threshold > 0.8); then, a large language model is used to analyze the current scene features and convert the anomaly description into a structured feature vector; then, path analysis is performed based on the predefined causal relationship pattern in the knowledge graph, using the shortest path algorithm (Dijkstra algorithm, with edge weights based on the strength of the association between nodes) while considering the temporal dependency of the nodes (with a time window set to ±6 hours) to construct an anomaly propagation link; finally, the graph attention network (GAT, with the number of attention heads set to 4) is used to weight the importance of the anomaly propagation path and identify the source node (confidence threshold > 0.9) and impact range of the anomaly.

[0069] (4-3) Solution reasoning: First, matching historical cases are retrieved from the knowledge graph, and a hybrid strategy of vector similarity and rule matching is adopted (vector similarity weight 0.6, rule matching weight 0.4); then the large language model is used to understand the current scenario constraints, including system load constraints (CPU utilization <80%, memory usage <85%), business impact constraints (maximum service interruption time allowed <10 minutes), and resource constraints (available computing resources, storage resources, etc.); then a combinatorial optimization algorithm (using a genetic algorithm, with a population size of 100, the number of iterations set to 50, a crossover probability of 0.8, and a mutation probability of 0.2) is used to generate a set of candidate solutions, and a multi-objective evaluation function (solution efficiency weight 0.4, resource consumption weight 0.3, and risk degree weight 0.3) is used to sort the solutions, and the solution with the highest comprehensive score is selected as the final recommended solution; finally, the reasoning results are structured and interpreted through the large language model to generate a detailed description including execution steps, expected results, and risk warnings, and the reasoning experience (including key indicators such as solution execution effect, solution time, and resource consumption) is written back into the knowledge graph for subsequent experience accumulation and rule optimization.

[0070] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be within the protection scope of the present invention.

Claims

1. A data anomaly diagnosis method based on knowledge graph and large model, characterized in that: The steps include: Acquire and preprocess multi-source data, including structured database records, semi-structured technical documents, and unstructured expert experience descriptions, and convert various types of data into a unified knowledge representation format through different preprocessing strategies; A knowledge graph is constructed based on the preprocessed data, wherein the knowledge graph includes entity level, relationship level and attribute level, and the systematic storage of data anomaly diagnosis knowledge is realized through multi-level knowledge representation; the knowledge graph is used to perform domain adaptation training on the large language model, and a training model with data anomaly diagnosis capability is obtained by injecting professional vocabulary and domain knowledge, combining the design of prompt templates and parameter fine-tuning; A hierarchical reasoning framework is constructed based on the training model and the knowledge graph. Through the coordinated operation of fast reasoning, deep reasoning, and solution reasoning, abnormality identification, diagnosis, and solution generation are achieved, and reasoning experience is continuously accumulated in the knowledge graph.

2. According to claim 1, a data anomaly diagnosis method based on knowledge graph and large model is characterized in that: The step of preprocessing multi-source data comprises: Perform field mapping and data cleaning on the structured database records, establish field mapping relationships by identifying key fields in the data table, perform data format unification and deduplication processing, and filter and correct abnormal values ​​and noise data; Template parsing and rule extraction are used for the semi-structured technical documents, a parsing template is constructed based on the structural features of the documents, key information is extracted using regular expressions, and the extracted information is converted into a unified data format; Using a large language model to perform semantic understanding and information extraction on the unstructured expert experience description, identify professional terms, diagnostic rules and processing methods in the text, extract key information on abnormal description, cause analysis and solution, and convert unstructured information into structured knowledge representation; The above preprocessed data are integrated and converted into knowledge triples of subject, predicate and object, including entity triples, relationship triples and attribute triples, for the subsequent construction of knowledge graph.

3. According to claim 1, a data anomaly diagnosis method based on knowledge graph and large model is characterized in that: The steps of constructing the knowledge graph include: constructing an entity hierarchy based on the preprocessed data, constructing a relationship hierarchy based on the entity hierarchy, and constructing an attribute hierarchy around entities and relationships.

4. According to claim 3, a method for diagnosing data anomalies based on knowledge graph and large model is characterized in that: The entity hierarchy is to establish a basic entity framework through the hierarchical relationship of data source systems, transmission nodes, processing components and storage facilities, and define exception type entities and solution entities on this basis to form a complete entity system.

5. According to claim 3, a method for diagnosing data anomalies based on knowledge graph and large model is characterized in that: The relationship hierarchy includes: establishing a data flow relationship, using directed edges to represent the transmission direction, transmission frequency and data volume between systems, and describing the data transmission path between systems; building a component dependency network, establishing a directed weighted graph based on the calling frequency, data interaction volume and configuration item correlation between components, and describing the strength of the dependency relationship between components; defining diagnostic knowledge relationships, including the attribution relationship between anomaly type and root cause, the mapping relationship between anomaly and diagnostic solution, and the evaluation relationship between solution and solution effect, to form a complete problem diagnosis knowledge network.

6. According to claim 3, a method for diagnosing data anomalies based on knowledge graph and large model is characterized in that: In the attribute hierarchy, basic attributes are used to describe the inherent characteristics of an entity, business attributes are used to characterize the business characteristics of an entity, and dynamic attributes are used to record state changes of an entity, forming a multi-dimensional attribute system.

7. The data anomaly diagnosis method based on knowledge graph and large model according to claim 1 is characterized in that: The step of performing domain adaptation training on the large language model includes: Build a professional vocabulary in a specific field based on the knowledge graph, extract entities and attributes from the knowledge graph to form a core vocabulary set, combine the large language model to analyze technical documents to identify new professional terms, automatically check and classify the professional vocabulary based on the preset domain vocabulary specifications, manually review and confirm the new professional terms, establish the upper and lower relationships and synonymous relationships between words, and form a structured professional vocabulary system; Design prompt templates according to the characteristics of abnormal diagnosis tasks. The prompt templates include abnormal description templates, cause analysis templates, solution templates, and verification feedback templates. Set corresponding trigger conditions and usage strategies for different types of abnormal scenarios, and dynamically optimize template content based on actual application effects. Convert professional rules, diagnostic experience and typical cases in the knowledge graph into training corpus in natural language, inject domain knowledge into model parameters through prompt learning, and enhance the model's ability to understand domain knowledge; The LoRA low-rank adaptation technique is used to fine-tune the model parameters.

8. The data anomaly diagnosis method based on knowledge graph and large model according to claim 1 is characterized in that: The constructing of hierarchical reasoning specifically includes: Perform fast reasoning, identify abnormal situations based on the preset rule patterns and statistical features in the knowledge graph, combine the large language model to understand the abnormal description content, classify the identified abnormalities and determine the processing priority; perform deep reasoning based on fast reasoning, retrieve historical experience and expert knowledge in the knowledge graph, use the large language model to analyze the current scene characteristics, build the abnormal propagation link through the predefined causal relationship pattern in the knowledge graph and the shortest path analysis between nodes, and identify the source node and impact range of the abnormality; Perform solution reasoning based on the inference results, retrieve matching historical cases from the knowledge graph, use the large language model to understand the current scenario constraints, and infer the optimal solution through combinatorial optimization; The reasoning process at each level forms a closed-loop feedback, the reasoning results are interpreted and analyzed through a large language model, and the reasoning experience is written back into the knowledge graph for experience accumulation and rule optimization.

9. A data anomaly diagnosis system based on knowledge graph and large model, characterized in that: include: A knowledge management module is used to build and maintain a knowledge graph. The knowledge management module builds entity, relationship and attribute hierarchies based on preprocessed multi-source data, and realizes efficient access to knowledge through a knowledge storage unit and a knowledge retrieval unit, while maintaining the timeliness and consistency of knowledge; A model processing module is used to perform training and reasoning of a large language model. The model processing module performs adaptive training on the model based on the domain knowledge in the knowledge graph, processes natural language input through a semantic understanding unit, and implements hierarchical reasoning functions using an inference execution unit; The hierarchical reasoning module is used to perform abnormal diagnosis tasks. The hierarchical reasoning module uses a fast reasoning unit to perform preliminary abnormality identification and classification, uses a deep reasoning unit combined with a knowledge graph to analyze the root cause, generates an optimal solution through a solution reasoning unit, and feeds back the reasoning results to the knowledge graph for experience accumulation.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method steps described in any one of claims 1 to 8 are implemented.

Images